omp-conductor 0.4.2 → 0.4.4

package/src/orchestrator-tick.ts

@@ -74,6 +74,8 @@ import {
   type ResolvedGrants,
   type Store,
 } from "./types.ts";
+import { formatDecisionDigest } from "./decisions.ts";
+import type { RunRecord } from "./types.ts";
 import { dbPath, openStore } from "./store.ts";
 
 /** The activation file. Absent means "this is not an orchestrator session". */
@@ -333,10 +335,29 @@ export function defaultTickMessage(
  * `REPORT_SCOPES` fails to compile here instead of resolving to `undefined` at
  * the point of use.
  */
+/**
+ * One line naming what the daemon recovered without asking (#132).
+ *
+ * The orchestrator used to write this paragraph by re-deriving it from the run
+ * rows every tick. Undefined when nothing was recovered: a line reading "0" is
+ * one nobody reads on the day it says 4.
+ */
+export function recoveryDigestLine(recovered: readonly RunRecord[]): string | undefined {
+  if (recovered.length === 0) return undefined;
+  const named = recovered
+    .slice(0, 5)
+    .map((r) => `${r.failureClass ?? "unknown"} #${r.issue}`)
+    .join(", ");
+  const rest = recovered.length > 5 ? `, +${recovered.length - 5} more` : "";
+  return `Auto-recovered since last tick: ${recovered.length} (${named}${rest}) — already handled, do not re-triage these.`;
+}
+
 export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScope]: string } = {
   material: "Report material events per your brief.",
   escalations:
     "Report NOTHING this turn except a Tier 1 or Tier 2 escalation; everything else -- releases included -- waits for the daily digest.",
+  decisions:
+    "Reporting scope decisions: interrupt only for a decision you need (tier-2) or a condition that stops the fleet. Every other material event accumulates and ships as ONE message with this tick's report via omp-conductor report -- a merge, a green PR, a pulled issue wait for the tick; nothing between ticks.",
 };
 
 /**
@@ -1154,6 +1175,18 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
           now - FRICTION_COOLDOWN_MS,
         );
         if (frictionSignals.length > 0) content = `${content}\n${formatFrictionDigest(frictionSignals)}`;
+        // What the session still owes its operator, read from the ledger rather
+        // than from what it remembers asking (#136). Appended every tick,
+        // because the whole failure was a question surviving in context only.
+        const decisions = formatDecisionDigest(frictionStore.openDecisions(scope.projectName), now);
+        if (decisions.length > 0) content = `${content}\n${decisions}`;
+        // What the daemon already fixed, so the session stops re-deriving that
+        // paragraph on every tick (#132). Two intervals wide rather than one: a
+        // tick that ran long must not drop the window it was meant to report.
+        const recovered = recoveryDigestLine(
+          frictionStore.recoveredSince(scope.projectName, now - 2 * config.intervalSeconds * 1_000),
+        );
+        if (recovered !== undefined) content = `${content}\n${recovered}`;
       } catch (err) {
         frictionStore?.close();
         frictionStore = undefined;

package/src/plugin.ts

@@ -13,13 +13,11 @@
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute } from "node:path";
 import {
-  checkBrief,
-  formatBriefStatus,
+  formatBriefReport,
   formatMigrateResult,
   inspectBriefLayout,
   migrateToPolicy,
   repairPolicyBannerCrumbs,
-  writeMergedBrief,
 } from "./brief-upgrade.ts";
 import { configPath, expandHome, findProject, loadConfig, resolveCaps, saveConfig } from "./config.ts";
 import { mechanismSatisfies, probeHost } from "./credentials.ts";
@@ -1424,11 +1422,7 @@ export default function conductorPlugin(pi: PluginApi): void {
             }
             if (layout.kind === "overlay") {
               ctx.ui.notify(
-                formatBriefStatus(path, {
-                  kind: "overlay",
-                  policyPath: layout.policyPath,
-                  orchestratorPath: layout.orchestratorPath,
-                }),
+                formatBriefReport(path, layout, []),
                 "info",
               );
               const repair = await ctx.ui.confirm(
@@ -1473,18 +1467,13 @@ export default function conductorPlugin(pi: PluginApi): void {
               }
               break;
             }
-            const status = checkBrief(readFileSync(path, "utf8"), rendered);
-            ctx.ui.notify(formatBriefStatus(path, status), "warning");
-            if (status.kind === "mergeable") {
-              const apply = await ctx.ui.confirm(
-                "Upgrade the brief?",
-                "Replace the half above the YOURS TO EDIT banner with the one this version ships? Everything below the banner is kept exactly as it is, and the current file is backed up first.",
-              );
-              if (apply) {
-                const backup = writeMergedBrief(path, status.merged);
-                ctx.ui.notify(`Brief upgraded. Previous version kept at ${backup}.`, "info");
-              }
-            }
+            // Hand-written: the plugin no longer merges single-file briefs
+            // (#131). There is no banner, so nothing here can tell which lines
+            // are the operator's — a retrofit has to name the cut first.
+            ctx.ui.notify(
+              `Hand-written brief at ${path} — run: omp-conductor brief-upgrade --retrofit (then --migrate). The plugin no longer merges single-file briefs.`,
+              "warning",
+            );
             break;
           }
 

package/src/session-host.ts

@@ -23,14 +23,13 @@
 import { connect } from "node:net";
 
 import { createLocalSession, disposeSession, type AgentSessionLike } from "./omp.ts";
-import type { OrchestratorJail, OrchestratorRefusal } from "./confinement.ts";
+
 import type { ReleaseShape, ResolvedGrants, SessionRole } from "./types.ts";
 
 /**
  * Everything the child needs to build the session. Plain JSON on purpose:
- * callbacks (`onReleaseBlocked`, the confinement audit sink) cannot cross a
- * process boundary, so they become messages instead — see
- * {@link HostToParent}.
+ * callbacks (`onReleaseBlocked`) cannot cross a process boundary, so they
+ * become messages instead — see {@link HostToParent}.
  */
 export interface SessionHostSpec {
   socket: string;
@@ -40,19 +39,13 @@ export interface SessionHostSpec {
   model?: string;
   resume?: boolean;
   releaseGrants?: ResolvedGrants;
-  /**
-   * Resolved by the *parent*, never by this process. `orchestratorJailFromConfig`
-   * reads the conductor config, and an isolated child cannot — a jail that
-   * silently fell back to defaults here would widen the very gate #127 closed.
-   */
-  orchestratorJail?: OrchestratorJail;
   /**
    * The conductor verb socket this session may call mutations on (#126).
    *
    * Carried in the spec rather than read from the environment by the child,
-   * for the same reason `orchestratorJail` is resolved by the parent: the
-   * child deciding *which* socket it owns is the child deciding which run it
-   * is, and that is the question the transport exists to stop it answering.
+   * for the same reason the grants are: the child deciding *which* socket it
+   * owns is the child deciding which run it is, and that is the question the
+   * transport exists to stop it answering.
    * Absent, the verbs are registered and every one of them fails closed.
    */
   verbSocketPath?: string;
@@ -71,8 +64,7 @@ export type HostToParent =
   | { t: "event"; event: unknown }
   | { t: "session-file"; path: string }
   | { t: "prompt-result"; id: number; ok: boolean; error?: string }
-  | { t: "release-blocked"; shape: ReleaseShape }
-  | { t: "confinement-refusal"; refusal: OrchestratorRefusal };
+  | { t: "release-blocked"; shape: ReleaseShape };
 
 /**
  * Depth at which a harness event stops being copied for the wire.
@@ -195,17 +187,13 @@ export async function runSessionHost(
       ...(spec.model === undefined ? {} : { model: spec.model }),
       ...(spec.resume === undefined ? {} : { resume: spec.resume }),
       ...(spec.releaseGrants === undefined ? {} : { releaseGrants: spec.releaseGrants }),
-      ...(spec.orchestratorJail === undefined ? {} : { orchestratorJail: spec.orchestratorJail }),
       ...(spec.verbSocketPath === undefined ? {} : { verbSocketPath: spec.verbSocketPath }),
-      // Both audit sinks live in the daemon's state directory, which this
-      // process may not be able to write and must not be trusted to. They
-      // become messages; the parent performs the durable write.
+      // The release audit lives in the daemon's state directory, which this
+      // process may not be able to write and must not be trusted to. It
+      // becomes a message; the parent performs the durable write.
       onReleaseBlocked: (shape) => {
         send({ t: "release-blocked", shape });
       },
-      onConfinementRefusal: (refusal) => {
-        send({ t: "confinement-refusal", refusal });
-      },
     });
   } catch (err) {
     send({ t: "start-error", message: err instanceof Error ? err.message : String(err) });

package/src/setup.ts

@@ -186,12 +186,18 @@ export const SETUP_DEFAULTS = {
 } as const;
 
 /**
- * The two report scopes as the operator meets them, described once. The wizard
+ * The three report scopes as the operator meets them, described once. The wizard
  * shows these labels, the plan summary quotes the description, and the rendered
- * brief spells the same two options out — so "material" cannot come to mean one
- * thing in the dialog and another in the session that has to honour it.
+ * brief spells the same three options out — so "material" cannot come to mean
+ * one thing in the dialog and another in the session that has to honour it.
  */
 export const REPORT_SCOPE_CHOICES: readonly { scope: ReportScope; label: string; description: string }[] = [
+  {
+    scope: "decisions",
+    label: "Decisions interrupt, rest batches",
+    description:
+      "tier-2 decisions and fleet-stopping conditions immediately; every other material event ships with the tick report",
+  },
   {
     scope: "material",
     label: "Material events",
@@ -204,6 +210,18 @@ export const REPORT_SCOPE_CHOICES: readonly { scope: ReportScope; label: string;
   },
 ];
 
+/**
+ * What a *fresh* interview opens on: the first choice above, by construction, so
+ * reordering that list moves the wizard's cursor with it.
+ *
+ * Deliberately not {@link DEFAULT_REPORT_SCOPE}. That one answers "a config on
+ * disk with no `reporting` key" and must stay `material` forever, because
+ * changing it would turn a running fleet's volume down on upgrade. This one
+ * answers "an operator being asked the question for the first time", where the
+ * recommended answer is the useful one — and they see it, and confirm it.
+ */
+export const SETUP_DEFAULT_REPORT_SCOPE: ReportScope = REPORT_SCOPE_CHOICES[0]!.scope;
+
 /**
  * What each precondition value means to the operator being asked about it, in
  * their words rather than the gate's.
@@ -625,7 +643,7 @@ export function defaultAnswers(projectName: string): SetupAnswers {
     policy: clonePolicy(SETUP_DEFAULTS.policy),
     credentials: { ...SETUP_DEFAULTS.credentials },
     orchestratorMode: SETUP_DEFAULTS.orchestratorMode,
-    reportScope: DEFAULT_REPORT_SCOPE,
+    reportScope: SETUP_DEFAULT_REPORT_SCOPE,
     writeOrchestratorBrief: false,
   };
 }

package/src/store.ts

@@ -14,8 +14,12 @@ import { mkdirSync } from "node:fs";
 import { dirname, join } from "node:path";
 
 import { stateDir } from "./config.ts";
-import { DEFAULT_CAPS } from "./types.ts";
+import { DECISION_TTL_MS, DEFAULT_CAPS } from "./types.ts";
 import type {
+  DecisionDraft,
+  FailureClass,
+  DecisionRecord,
+  DecisionState,
   DispatchSummary,
   FrictionAdmissionReason,
   FrictionKind,
@@ -27,6 +31,7 @@ import type {
   ReportEnqueue,
   ReportKind,
   ReportRecord,
+  RecoveryAction,
   RunRecord,
   RunState,
   SessionRole,
@@ -105,6 +110,9 @@ const UPDATABLE_COLUMNS: Record<string, true> = {
   endedAt: true,
   lastError: true,
   settlementFlags: true,
+  failureClass: true,
+  recoveryAction: true,
+  recoveredAt: true,
 };
 
 /** Everything SQLite will accept from us. */
@@ -133,6 +141,9 @@ interface RunRow {
   endedAt: number | null;
   lastError: string | null;
   settlementFlags: string | null;
+  failureClass: string | null;
+  recoveryAction: string | null;
+  recoveredAt: number | null;
 }
 
 interface FrictionRollupRow {
@@ -216,7 +227,10 @@ CREATE TABLE IF NOT EXISTS runs (
   startedAt   INTEGER NOT NULL,
   endedAt     INTEGER,
   lastError   TEXT,
-  settlementFlags TEXT
+  settlementFlags TEXT,
+  failureClass TEXT,
+  recoveryAction TEXT,
+  recoveredAt INTEGER
 );
 CREATE INDEX IF NOT EXISTS runs_project_issue ON runs (project, issue);
 CREATE INDEX IF NOT EXISTS runs_project_state ON runs (project, state);
@@ -317,6 +331,34 @@ CREATE TABLE IF NOT EXISTS merge_locks (
   prUrl   TEXT    NOT NULL,
   at      INTEGER NOT NULL
 );
+
+-- Questions the orchestrator has put to its operator, and their answers (#136).
+--
+-- The reason this is a table and not the session's memory: a question lived only
+-- in the model's context, so a compaction, a restart or a tick that ran long
+-- lost both the question and the fact that it was owed one. The session then
+-- either re-asked (the operator answers twice) or silently dropped it (the
+-- decision never lands, and nothing anywhere says a decision is outstanding).
+--
+-- The 'condition' column is a machine-checkable precondition for the answer
+-- becoming actionable -- a PR merging, an issue closing, a version on npm --
+-- stored as the raw string an operator or session wrote, parsed on read. Once
+-- met, 'conditionMetAt' is what turns a parked question into one the tick digest
+-- pushes at the session.
+CREATE TABLE IF NOT EXISTS decisions (
+  id             TEXT    PRIMARY KEY,
+  project        TEXT    NOT NULL,
+  question       TEXT    NOT NULL,
+  blocks         TEXT,
+  askedAt        INTEGER NOT NULL,
+  expiresAt      INTEGER NOT NULL,
+  condition      TEXT,
+  conditionMetAt INTEGER,
+  state          TEXT    NOT NULL,
+  resolvedAt     INTEGER,
+  resolution     TEXT
+);
+CREATE INDEX IF NOT EXISTS decisions_project_state ON decisions (project, state);
 `;
 
 /**
@@ -392,6 +434,9 @@ function toRecord(row: RunRow): RunRecord {
     const flags = toSettlementFlags(row.settlementFlags);
     if (flags !== undefined) record.settlementFlags = flags;
   }
+  if (row.failureClass !== null) record.failureClass = row.failureClass as FailureClass;
+  if (row.recoveryAction !== null) record.recoveryAction = row.recoveryAction as RecoveryAction;
+  if (row.recoveredAt !== null) record.recoveredAt = row.recoveredAt;
   return record;
 }
 
@@ -420,6 +465,38 @@ function toReport(row: ReportRow): ReportRecord {
   return record;
 }
 
+interface DecisionRow {
+  id: string;
+  project: string;
+  question: string;
+  blocks: string | null;
+  askedAt: number;
+  expiresAt: number;
+  condition: string | null;
+  conditionMetAt: number | null;
+  state: string;
+  resolvedAt: number | null;
+  resolution: string | null;
+}
+
+/** Same NULL-to-absent contract as {@link toReport}. */
+function toDecision(row: DecisionRow): DecisionRecord {
+  const record: DecisionRecord = {
+    id: row.id,
+    project: row.project,
+    question: row.question,
+    askedAt: row.askedAt,
+    expiresAt: row.expiresAt,
+    state: row.state as DecisionState,
+  };
+  if (row.blocks !== null) record.blocks = row.blocks;
+  if (row.condition !== null) record.condition = row.condition;
+  if (row.conditionMetAt !== null) record.conditionMetAt = row.conditionMetAt;
+  if (row.resolvedAt !== null) record.resolvedAt = row.resolvedAt;
+  if (row.resolution !== null) record.resolution = row.resolution;
+  return record;
+}
+
 /**
  * Long enough that a collision is not a thing anyone has to handle, short
  * enough that an operator can compare it against the id printed in a Telegram
@@ -587,6 +664,19 @@ export function openStore(dbPath: string): Store {
   if (!columns.some((column) => column.name === "settlementFlags")) {
     db.exec("ALTER TABLE runs ADD COLUMN settlementFlags TEXT");
   }
+  // Every row written before #132 is unclassified, and NULL is the honest
+  // reading of that: the budget counters below deliberately still count an
+  // unclassified terminal row exactly as this release's predecessor did, so an
+  // upgrade never silently re-opens a budget an operator had already spent.
+  for (const [name, type] of [
+    ["failureClass", "TEXT"],
+    ["recoveryAction", "TEXT"],
+    ["recoveredAt", "INTEGER"],
+  ] as const) {
+    if (!columns.some((column) => column.name === name)) {
+      db.exec(`ALTER TABLE runs ADD COLUMN ${name} ${type}`);
+    }
+  }
 
   const insertRun = db.query<unknown, SqlValue[]>(
     `INSERT INTO runs (
@@ -626,13 +716,53 @@ export function openStore(dbPath: string): Store {
   const countAttempts = db.query<{ n: number }, [string, number]>(
     `SELECT COUNT(*) AS n FROM runs WHERE project = ? AND issue = ?`,
   );
+  // The classes excluded here are the ones whose cause is not the work (#132): a
+  // runner that never produced a verdict, a row whose PR had already merged, a
+  // kill that came from a daemon restart rather than from a turn ceiling. On this
+  // fleet #350 spent its whole continuation budget on causes like those and then
+  // sat in admission hold for six dispatch cycles. An unclassified row (NULL) is
+  // counted exactly as before, so upgrading changes no existing budget.
   const countFailures = db.query<{ n: number }, [string, number]>(
     `SELECT COUNT(*) AS n FROM runs
-      WHERE project = ? AND issue = ? AND state = 'failed'`,
+      WHERE project = ? AND issue = ? AND state = 'failed'
+        AND (failureClass IS NULL OR failureClass NOT IN ('ci-infra', 'settlement-stuck'))`,
   );
   const countContinuations = db.query<{ n: number }, [string, number]>(
     `SELECT COUNT(*) AS n FROM runs
-      WHERE project = ? AND issue = ? AND state IN ('killed', 'orphaned', 'blocked')`,
+      WHERE project = ? AND issue = ? AND state IN ('killed', 'orphaned', 'blocked')
+        AND (failureClass IS NULL OR failureClass NOT IN ('admin-kill', 'settlement-stuck'))`,
+  );
+  // Newest first, and bounded: every row this returns costs `gh` calls to gather
+  // facts for, so a fleet with a long unclassified history classifies over
+  // several ticks rather than spending one tick's budget on all of it.
+  //
+  // Classified-but-unrecovered rows are included, not just unclassified ones: a
+  // recovery whose tracker write failed has to come back, or the log line saying
+  // "retrying next tick" is a lie and the row is stranded with a class and no
+  // action. `hold` is excluded because it is *recorded only* by design — its
+  // `recoveredAt` stays NULL forever, and re-offering it would spin the sweep.
+  const selectUnclassified = db.query<RunRow, [string, number]>(
+    `SELECT * FROM runs
+      WHERE project = ?
+        AND state IN ('blocked', 'killed', 'failed', 'orphaned', 'pushed-green')
+        AND (
+          failureClass IS NULL
+          OR (recoveredAt IS NULL AND recoveryAction IN ('settle', 'continue', 'requeue', 'rerun-checks'))
+        )
+      ORDER BY startedAt DESC, rowid DESC
+      LIMIT ?`,
+  );
+  const selectFailureClassCounts = db.query<{ cls: string; n: number }, [string]>(
+    `SELECT failureClass AS cls, COUNT(*) AS n FROM runs
+      WHERE project = ? AND failureClass IS NOT NULL AND recoveredAt IS NULL
+        AND state IN ('blocked', 'killed', 'failed', 'orphaned', 'pushed-green')
+      GROUP BY failureClass
+      ORDER BY n DESC, failureClass ASC`,
+  );
+  const selectRecoveredSince = db.query<RunRow, [string, number]>(
+    `SELECT * FROM runs
+      WHERE project = ? AND recoveredAt IS NOT NULL AND recoveredAt >= ?
+      ORDER BY recoveredAt DESC, rowid DESC`,
   );
   // Salvage state that still describes an issue's present, so an operator is
   // shown a preserved WIP tip exactly while it is the thing a re-claim would
@@ -777,6 +907,39 @@ export function openStore(dbPath: string): Store {
       ORDER BY createdAt ASC, rowid ASC`,
   );
 
+  const insertDecision = db.query<never, [string, string, string, SqlValue, number, number, SqlValue, string]>(
+    `INSERT INTO decisions
+       (id, project, question, blocks, askedAt, expiresAt, condition, state)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+  );
+  const selectDecision = db.query<DecisionRow, [string]>(`SELECT * FROM decisions WHERE id = ?`);
+  const selectOpenDecisions = db.query<DecisionRow, [string]>(
+    `SELECT * FROM decisions
+      WHERE project = ? AND state = 'open'
+      ORDER BY askedAt ASC, rowid ASC`,
+  );
+  const selectDueDecisions = db.query<DecisionRow, [string, number]>(
+    `SELECT * FROM decisions
+      WHERE project = ? AND state = 'open' AND expiresAt <= ?
+      ORDER BY askedAt ASC, rowid ASC`,
+  );
+  // `state = 'open'` in the WHERE is the double-resolve guard: the second call
+  // changes no rows and returns false rather than overwriting the first answer.
+  const resolveDecisionRow = db.query<never, [string, string, number, string]>(
+    `UPDATE decisions SET state = ?, resolution = ?, resolvedAt = ?
+      WHERE id = ? AND state = 'open'`,
+  );
+  const expireDecisionRows = db.query<never, [number, string, number]>(
+    `UPDATE decisions SET state = 'expired', resolvedAt = ?, resolution = 'expired unanswered'
+      WHERE project = ? AND state = 'open' AND expiresAt <= ?`,
+  );
+  // Set once: a condition that flickers must not keep moving its own timestamp,
+  // or the digest's "act on this now" would reset to looking new every tick.
+  const markConditionMetRow = db.query<never, [number, string]>(
+    `UPDATE decisions SET conditionMetAt = ?
+      WHERE id = ? AND state = 'open' AND conditionMetAt IS NULL`,
+  );
+
   const insertVerbLedger = db.query<unknown, SqlValue[]>(
     `INSERT INTO verb_ledger
        (id, project, runId, issue, verb, role, args, decision, refusal, detail, sha, at)
@@ -1152,6 +1315,69 @@ export function openStore(dbPath: string): Store {
       return selectOpenReports.all(project).map(toReport);
     },
 
+    runsNeedingClassification(project: string, limit = 20): RunRecord[] {
+      return selectUnclassified.all(project, limit).map(toRecord);
+    },
+
+    failureClassCounts(project: string): { cls: FailureClass; n: number }[] {
+      return selectFailureClassCounts
+        .all(project)
+        .map((row) => ({ cls: row.cls as FailureClass, n: row.n }));
+    },
+
+    recoveredSince(project: string, since: number): RunRecord[] {
+      return selectRecoveredSince.all(project, since).map(toRecord);
+    },
+
+    createDecision(draft: DecisionDraft): DecisionRecord {
+      const record: DecisionRecord = {
+        id: crypto.randomUUID(),
+        project: draft.project,
+        question: draft.question,
+        askedAt: draft.at,
+        expiresAt: draft.at + DECISION_TTL_MS,
+        state: "open",
+      };
+      if (draft.blocks !== undefined) record.blocks = draft.blocks;
+      if (draft.condition !== undefined) record.condition = draft.condition;
+      insertDecision.run(
+        record.id,
+        record.project,
+        record.question,
+        toSql(record.blocks),
+        record.askedAt,
+        record.expiresAt,
+        toSql(record.condition),
+        record.state,
+      );
+      return record;
+    },
+
+    openDecisions(project: string): DecisionRecord[] {
+      return selectOpenDecisions.all(project).map(toDecision);
+    },
+
+    resolveDecision(id: string, state: "answered" | "withdrawn", resolution: string, at: number): boolean {
+      return resolveDecisionRow.run(state, resolution, at, id).changes > 0;
+    },
+
+    markDecisionConditionMet(id: string, at: number): boolean {
+      return markConditionMetRow.run(at, id).changes > 0;
+    },
+
+    expireDueDecisions(project: string, now: number): DecisionRecord[] {
+      const due = selectDueDecisions.all(project, now);
+      if (due.length === 0) return [];
+      expireDecisionRows.run(now, project, now);
+      // Re-read for the same reason `recoverSendingReports` does: the caller
+      // renders these, and a row that still says `open` while the ledger says
+      // `expired` is the disagreement this table exists to remove.
+      return due
+        .map((row) => selectDecision.get(row.id))
+        .filter((row): row is DecisionRow => row !== null)
+        .map(toDecision);
+    },
+
     appendVerbLedger(draft: VerbLedgerDraft): VerbLedgerEntry {
       const entry: VerbLedgerEntry = { ...draft, id: crypto.randomUUID(), at: Date.now() };
       insertVerbLedger.run(